A breach notice shows up and the first question is almost always the same. Am I owed money? Most of the time the answer is no, not from the breach itself. What actually gets money back into your account is a separate rule, and it starts running the moment you spot a charge you didn't make.
That rule is Regulation E. It covers debit cards, ATM withdrawals, ACH pulls, and automatic bill payments. Credit cards sit outside it. So does a breach that never touched your account.
The two-day and 60-day clocks
Under 12 CFR 1005.6, what you owe after unauthorized transfers depends on how fast you tell your bank.
| When you report | Your liability |
|---|---|
| Within 2 business days of learning of the loss or theft | Up to $50, or the amount taken before you called, whichever is less |
| After 2 business days, but within 60 days of the statement showing the charge | Up to $500 |
| More than 60 days after the statement | Everything taken after the 60 days |
The 60-day rule is the one people miss. It runs from the day your bank sends the statement showing the unauthorized transfer, not the day you noticed. Wait longer, and the exposure grows fast.
The CFPB's interpretation adds a detail that matters. Two business days means two 24-hour periods, not two days your branch happens to be open. Learn about the theft on a Friday night and the clock doesn't wait for Monday.
What your bank has to do next
Once you report, the bank investigates. If it can't wrap up in 10 business days, it generally has to put the disputed amount back in your account while it works. Skip a written follow-up the bank asks for and it can pull that temporary credit. The investigation usually resolves in 45 days, or up to 90 for certain transaction types, according to the CFPB's consumer guidance.
And the reason this matters so much is that debit disputes are unforgiving. The money's gone. You can't just refuse to pay a debit card the way you can refuse a credit card bill, and the bank is not on the hook the way a credit issuer is, which means the whole burden of proving what happened and when falls on you and on the timeline you kept.
Credit cards follow a different rulebook
Credit cards fall under the Fair Credit Billing Act. You have 60 days from the statement date to dispute a charge in writing. In practice, the big networks go further and offer zero liability for fraud. That's card policy, not federal law, and it can change.
To be honest, most people never need the statute. The networks handle fraud disputes faster than the law requires, and they usually eat the loss to keep you as a customer.
Here's the practical difference. With a credit card, the bank's money is on the line while the dispute plays out. With debit, your money leaves first and comes back later, if the dispute goes your way. Same fraud, very different week.
What a breach notice doesn't give you
The breach itself is not a claim. You need harm a court can point to, and "my email was in a database" is rarely enough on its own.
HIPAA makes this plain. There's no private right of action. You can't sue a hospital or an insurer under HIPAA for a breach. What you can do is file a complaint with the federal Office for Civil Rights.
Filing a HIPAA complaint
Use the OCR complaint portal. The general deadline is 180 days from when you knew or should have known about the problem, and the filing rules come from 45 CFR 160.306. The HHS complaint guidance walks through what to include.
Outcomes vary more than people expect:
- No violation found, or not enough evidence.
- Technical assistance or voluntary compliance by the entity.
- A corrective action plan with monitoring.
- Formal enforcement, which is possible but not the default.
State attorneys general can also bring civil actions under HITECH on behalf of residents. That path exists whether or not you file anything yourself.
California's narrow private right of action
California gives consumers a private right of action, but only for a specific kind of breach. The exposed data has to fall into the categories defined in Civil Code section 1798.81.5, and it has to be unencrypted and unredacted. If the company encrypted the data properly, the claim gets much harder.
Statutory damages run from $100 to $750 per consumer per incident. You have to give the business 30 days' written notice first, and they get a chance to cure. Recent settlements show the range: General Motors at $12.75 million, Disney at $2.75 million, and a few others in the low millions.
Thing is, most breaches don't fit this mold. The data was encrypted, or it wasn't the kind of information the statute covers, or the harm is speculative. That's why the class action you read about rarely turns into a check for you.
Step-by-step when money is actually missing
- Call your bank the same day you notice. Use the number on the back of your card, not a number from an email.
- Follow up in writing within 10 business days if the bank asks.
- Circle the 60-day statement deadline on your calendar.
- Keep copies of everything you file, including a police report if you make one.
- If the bank denies the claim, ask for the specific reason in writing and escalate through the CFPB's unauthorized transaction guidance.
When the breach didn't touch your account
Freeze your credit. Change reused passwords. Watch for phishing that references the breach by name. None of that produces a payout. It does reduce the odds of a second, worse event.
Turns out the most useful thing after a breach is usually not a lawsuit. It's a phone call you make within 48 hours.